IMPORTANT: No additional bug fixes or documentation updates will be released for this version. For the latest information, see the current release documentation.
Elastic Docs ›Elastic Security Solution [8.6] ›Downloadable rule update v8.6.8
« Appendix Y: Downloadable rule update v8.6.8 Threat Intel Hash Indicator Match »

Threat Intel IP Address Indicator Matchedit

This rule is triggered when an IP address indicator from the Threat Intel Filebeat module or integrations has a match against a network event.

Rule type: threat_match

Rule indices:

  • auditbeat-*
  • endgame-*
  • filebeat-*
  • logs-*
  • packetbeat-*
  • winlogbeat-*

Severity: critical

Risk score: 99

Runs every: 1h

Searches indices from: now-65m (Date Math format, see also Additional look-back time)

Maximum alerts per execution: 100

References:

Tags:

  • OS: Windows
  • Data Source: Elastic Endgame
  • Rule Type: Indicator Match

Version: 1

Rule authors:

  • Elastic

Rule license: Elastic License v2

Rule queryedit

source.ip:* or destination.ip:*
« Appendix Y: Downloadable rule update v8.6.8 Threat Intel Hash Indicator Match »